T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/url_import.py:31- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
str: """Fetch HTML content.""" req = urllib.request.Request( url, headers={ 'User-Agent': 'huo15-ppt/3.8 (https://huo15.com; +mailto:postmaster@huo15.com)', 'Accept': 'text/html,application/xhtml+xml', 'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8', }, ) with urllib.request.urlopen(req, timeout=timeout) as resp: ctype = resp.headers.get('Content-Type', '') m = re.search(r'charset=([^\s;]+)', ctype) encoding = m.group(1) if m else 'utf-8' try: return resp.read().decode(encoding, errors='replace') except LookupError: return resp.read().decode('utf-8', errors='replace') ``` The fetched content is subsequently incorporated into an LLM request at `scripts/url_import.py:125-144`: ```python text = html_to_text(html) if args.print_extracted: print(text) return from prompt_to_deck import call_claude, is_llm_enabled, DEFAULT_MODELS enabled, reason = is_llm_enabled() if not enabled: sys.exit(1) full_prompt = ( f"Create a presentation from the following web content. Source URL: {args.url}\n\n" f"=== Web Content ===\n\n{text}" ) model = args.model or os.environ.get('ANTHROPIC_MODEL') or DEFAULT_MODELS['balanced'] deck = call_claude( full_prompt, pack_override=args.pack, slides=args.slides, model=model ) ``` ### Technical Analysis The command-line URL is passed directly to `urllib.request.urlopen()` without applying destination or protocol restrictions. The implementation does not: - Restrict requests to HTTP or HTTPS. - Reject loopback, private, link-local, multicast, unspecified, or reserved addresses. - Block cloud-instance metad ...[truncated 2035 chars]- Remediation
View remediation